Supplemental Terms

Revised and effective: March 27, 2026

These Supplemental Terms (“Supplemental Terms”) apply to specific Services or aspects of Services described herein and supplement and form a part of the Services Agreement found at https://capacity.com/services-agreement/ between Subscriber and AI Software, LLC d/b/a “Capacity” unless Subscriber has a written master services agreement executed between Subscriber and Capacity for the Services, in which case these Supplemental Terms will supplement and form a part such written master services agreement (in either case, the “Agreement”).

If you are a new Subscriber, then these Supplemental Terms will be effective as to any Service Order entered into after the effective date above. If you are an existing Subscriber of any of our brands which refer to online terms of service, subscription or services agreement or the like as of the effective date above, then Capacity is providing you with prior notice of the changes to our Agreement with you, which will be effective as of one month after the effective date above.

Terms used herein but not defined herein have the meanings set forth in the Agreement. Notwithstanding anything to the contrary in the Agreement, Capacity reserves the right, at its sole discretion, to update the Supplemental Terms in relation to the development of new or updates to existing features and functionality of the Services or applicable law. Subscriber’s continued usage of the Services may be relied upon by Capacity as Subscriber’s acceptance of the then-current version of these Supplemental Terms.

Implementation Services

As set forth in the Subscriber’s Service Order, Capacity’s Services typically include implementation, set-up and on-boarding services, which we refer to as “Implementation Services.” In most cases, completion of the implementation services is subject to Subscriber’s fulfillment of certain Subscriber obligations described in the Service Order Schedule or otherwise provided to Subscriber in writing. Implementation Services are subject to cooperation by Subscriber with its obligations and provision of access to applicable technology and Subscriber Data including test data. For any Integrations listed in the Service Order for which Capacity has agreed to assist with an integration, if Subscriber fails to provide suitable access, then Capacity may instead, for the same price, permit Subscriber to develop the applicable integration on the Capacity Developer Platform at the same price.

Please note that Implementation Services are defined and billed separately as set forth in the Service Order, and included Customer Success Services are defined as set forth in the Service Order (see below). Professional services or managed services are only provided if defined and set forth explicitly in the Service Order, in which case the terms and conditions of such professional or managed services will be outlined in the Service Order or a schedule thereto.

Customer Success Services Packages

Capacity offers tiered Customer Success Services packages which are described in Subscriber’s Service Order. Capacity does not offer telephone support to Subscribers, but rather offers support via email, in-Service communications, and electronic messages.

Recording of Communications, Tracking Technologies, Session Replay, and Outbound Email

Subscriber is responsible for maintaining appropriate notice, consent, opt-in, and opt-out mechanisms as required by Data Protection Laws to enable Subscriber to utilize the Services to communicate with its Users and to lawfully collect data from such Users. This includes compliance with laws governing the specific communication channels Subscriber elects to use, such as chat, email, SMS, and voice.

Tracking Technologies. In performance of the Services, Capacity employs cookies, unique identifiers, web beacons, and similar tracking technologies, which Subscriber acknowledges. Subscriber's privacy policy should describe Subscriber's use of such technologies, and Subscriber should provide a hyperlink to such policy in chatbot or other messaging communications.

Recording of Communications. Subscriber is responsible for obtaining all required consents before recording Users' voices, chats, or other interactions with Subscriber's website and technologies, including the Services. Certain jurisdictions require consent from all parties to a communication before recording, including but not limited to California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington. Subscriber is solely responsible for determining which recording consent laws apply to its use of the Services and for obtaining any required consents before recording.

Real-Time Transcription. Subscriber acknowledges that real-time transcription of voice communications, including transcription performed to enable Agent Assist, Conversational Intelligence, or similar features of the Services, constitutes recording under applicable federal and state wiretapping and electronic surveillance laws. Subscriber is solely responsible for ensuring that all required recording disclosures and consents are in place before activating any feature that involves real-time transcription of live communications, regardless of whether a persistent audio recording is retained.

Voice Features and Biometric Data. Subscriber acknowledges that voice-based features of the Services, including speech-to-text and text-to-speech functionality, involve the collection and processing of voice data. In certain jurisdictions, voice data, voiceprints, or voice recordings may constitute biometric identifiers or biometric information subject to specific legal requirements. These jurisdictions include but are not limited to Illinois (Biometric Information Privacy Act), Texas (Capture or Use of Biometric Identifier Act), and Washington (H.B. 1493). Such laws may require Subscriber to provide specific written disclosures, obtain informed written consent prior to collection, and adhere to data retention and destruction requirements that exceed general privacy law obligations. Subscriber is solely responsible for determining whether biometric privacy laws apply to its use of voice features and for implementing all required notices, consents, and data handling practices.

Session Replay and Screen Recording. The Services may include session replay and screen recording functionality that captures User interactions with Subscriber's website or application, and, where enabled, Subscriber's agents' screens during customer interactions. Subscriber is responsible for disclosing its use of session replay and screen recording technologies in its privacy policy and for obtaining any consents required under applicable law. Where screen recording captures Subscriber's employees' or agents' screens, Subscriber is solely responsible for providing advance notice to such employees or agents and for complying with all applicable workplace surveillance and employee monitoring laws. Subscriber is solely responsible for implementing appropriate safeguards prior to enabling screen recording, including data masking, field redaction, or screen exclusion configurations, to prevent the capture of data that Subscriber is prohibited from sharing or that would trigger additional regulatory obligations. Capacity is not responsible for sensitive data captured in screen recordings where Subscriber has not implemented appropriate masking or redaction measures.

Email Compliance- CAN-SPAM. If Subscriber uses the Services to send commercial email messages, Subscriber is solely responsible for compliance with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and applicable state email marketing laws, including requirements for accurate header and subject line information, identification of messages as advertisements where required, inclusion of a valid physical postal address, and provision of a functional unsubscribe mechanism that is honored within ten business days.

General. The foregoing does not constitute legal advice. Subscriber should consult with its own legal counsel to determine its obligations under applicable law and to ensure that its notices, consent mechanisms, and data handling practices are compliant.

Intelligent Virtual Agents Services

If Subscriber’s Service Order includes Intelligent Virtual Agents (referred to as SMS IVA, Voice IVA, Chat IVA and/or Email IVA), then the following sections apply:

1. If Subscriber’s Service Order includes Services using SMS, MMS and/or RCS, then Subscriber acknowledges and agrees that such messaging services are provided by way of transmissions between local and/or international telecommunications networks and that Subscriber can have no expectation of privacy concerning such transmissions of Subscriber Data, provided, however, that any Subscriber Data that is ultimately at rest with and stored by Capacity on Subscriber’s behalf will be protected in accordance with the relevant terms of this Agreement.

2. Capacity treats all communications transmitted via Capacity’s platform(s) - regardless of use case or phone number type (e.g., long code, short code, or toll-free) - as Application-to-Person (“A2P”) messaging; accordingly, the communications utilizing the Services are subject to various laws and regulations.

3. Subscriber may not use the Services to transmit or store any content or communications (commercial or otherwise) in violation of relevant law or the Acceptable Use Policies listed at www.capacity.com/acceptable-use. Capacity reserves the right to request and review evidence of such compliance.

4. In connection with sending SMS/MMS through the Services, Capacity disclaims any liability with regards to (i) third-party wireless service providers ("Carriers") or (ii) third-party intermediaries that transmit SMS/MMS messages between Providers and Carriers ("Aggregators"), including regarding system capacity, message throughput, or actual delivery to an End User's device. In addition, Carriers and/or Aggregators may charge additional per-message fees for SMS/MMS messages. Capacity will invoice Subscribers monthly in arrears for such fees, if any.

5. Telecommunications carriers enforce mandatory registration and verification processes for businesses, as well as fees and fines. Subscribers using text messaging on 10-digit long code (10DLC) and toll-free (TFN) phone numbers will be required to provide the necessary information to complete this registration and verification process. During the registration process, text functionality may be limited or blocked. Carriers impose fines for violations of message content rules (such as phishing, smishing and social engineering, illegal content and SHAFT).  Any fine imposed on Capacity with respect to Subscriber’s messages will be passed on to Subscriber.  Subscriber acknowledges that his, her or its business owns the land-line or toll-free number listed in its Service Order and has authorized Capacity to sign any associated Letter of Authorization for Texting Enablement.

6. Subscriber shall at all times extend co-operation to Carriers and other the third-party service provider(s) in respect of any inquiry or investigation in relation to use or users of the phone connection. Subscriber shall provide all applicable information as soon as requested by Capacity (no more than 24 hours). Subscriber agrees that it shall furnish information and all documents, from time to time, including any undertaking or declaration as may be required by third-party service provider(s) for the benefit of such service provider(s) in respect of Services.

7. Via the Services, Subscriber may send a message-based, one-way or two-way conversation utilizing A2P Messaging that an End User consents to receive (or otherwise “opts in” to in accordance with customary industry standards and applicable law)(a “Campaign”). Subscriber acknowledges that Capacity has no obligation to pre-screen, although Capacity reserves the right in its sole discretion to pre-screen, refuse or remove any Campaigns. The following applies to Campaigns:

• Short Codes: Any Short Code Campaign must be pre-registered and pre-approved by wireless carriers.
• TFNs: Any TFN use cases must be verified pursuant to prevailing industry standards.
• TNs: Any 10DLC Campaign must be pre-registered pursuant to prevailing industry standards.
• In the absence of any applicable industry standards, as reasonably determined by Capacity, a Campaign use case must be registered with Capacity.

8. Subscriber represents and warrants that (i) Subscriber has or has procured all power and authority necessary to use and text enable those phone numbers it registers or associates with the Account, (ii) Subscriber will not use the Services on a phone number that has been exchanged, rented, or purchased from a third party without the permission of the phone number owner, (iii) the phone number is not a mobile subscriber phone number, and (iv) Subscriber agrees to execute any additional documents necessary to ensure its authority to use and text enable those phone numbers.

9. Subscriber is responsible for determining whether the Services offer appropriate safeguards for Subscriber’s business, including, but not limited to, any safeguards required by applicable law or regulation, prior to transmitting or processing, or prior to permitting End Users to transmit or process, any data or communications via the Services.

10. Subscribers use of the Services may include access to Capacity’s API. Capacity may limit: (i) the number of network calls that Subscriber may make via API; (ii) the maximum file size; and (iii) the maximum content that may be accessed, or anything else about the API and Subscriber’s Campaign it accesses that Capacity deem appropriate, in each case in our sole discretion. Capacity may utilize technical measures to prevent over-usage or stop usage of the API by Subscriber or any other User after any usage limitations are exceeded or suspend Subscriber’s access to the API with or without notice in the event Subscriber exceeds any such limitations.

11. Subscriber expressly agrees that: (i) the Services are not intended to be used for any emergency services that are designed to be routed based upon the location of the origination of the communication or to supply the receiving party with such location information (including, but not limited to, 911 in North America, 112 in Europe, and 999 and 110 and other emergency calling codes where used) (“Emergency Communications”); (ii) Subscriber has arranged for other effective and reliable methods for Emergency Communications to be available at all times to any persons who may have occasion to use the Services; and (iii) Subscriber has trained all such users and posted conspicuous reminder notices that would be seen by all such potential users that alternatives to the Services should be used for Emergency Communications.

12. Subscriber must exercise caution and judgment when changing Carriers; including porting voice service from one carrier to another which may break the texting route. Capacity has no control over this so Subscriber must check with its carrier prior to porting any phone numbers. Subscriber remains responsible for all charges associated with the Account notwithstanding a break in the texting route as a result of change of carriers.

13. Subscriber may not distribute the saved output of Voice IVA, in any manner, including, bt not limited to, audio files, as a part of applications, materials or multimedia works created by or for Subscriber or otherwise rent, resell, lease, or lend the generated output to any third party. Subscriber may not play back the saved Voice IVA output in public or otherwise make it publicly available. Subscriber may not disclose the results of any benchmark or performance test of the Voice IVA Services to any third party without Capacity’s prior written approval;

14. Subscriber agrees that Capacity retains the right to create reasonable limits on Capacity’s use and storage of Subscriber Data, such as limits on file size, storage space, processing capacity, and similar limits.

Agent Assist and Conversational Intelligence Services

Agent Assist provides AI-generated recommendations, suggested responses, and guidance to Subscriber's agents during live customer interactions. Conversational Intelligence analyzes historical and real-time interaction data to surface trends, quality insights, and automation opportunities. Both services rely on real-time transcription and, where enabled, call recording. If Subscriber's Service Order includes Real-Time Agent Assist, Conversational Intelligence, or similar analytics services, then the following sections apply:

1. AI-generated guidance surfaced through Agent Assist is provided for informational purposes only and may contain inaccuracies, incomplete information, or recommendations that are not appropriate for a particular interaction or regulatory context. Capacity does not warrant the accuracy, completeness, or suitability of any AI-generated guidance. Subscriber is solely responsible for ensuring that its agents exercise independent professional judgment in their roles. Subscriber is solely responsible for ensuring that its agents follow required scripts and procedures regardless of any conflicting or inconsistent AI-generated guidance.
   
2. Subscriber's use of Agent Assist and Conversational Intelligence is subject to the Recording of Communications section of these Supplemental Terms. Subscriber shall ensure that call recording disclosures are presented to all parties before any transcription or recording begins and that such disclosures are appropriate for each jurisdiction in which the Services are deployed.
   
3. Subscriber acknowledges that Agent Assist and Conversational Intelligence may involve monitoring, transcribing, recording, and analyzing Subscriber's employees' communications and work performance. Subscriber is solely responsible for compliance with all applicable laws and regulations governing employee monitoring and workplace surveillance.

AI in the Capacity Platform

Learn more about AI in the Capacity platform here: AI in the Capacity Platform. Subscriber acknowledges that the Services include artificial intelligence and machine learning features that generate automated responses, recommendations or content. Subscriber is solely responsible for (i) determining whether applicable law requires disclosure to Users that they are interacting with AI or automated systems, (ii) making all required disclosures, (iii) ensuring that AI-generated outputs are reviewed for accuracy and appropriateness before use in regulated or high-risk contexts, and (iv) usage in accordance with any instructions for use provided by Capacity. Subscriber shall not use AI features of the Services for banned usages under the EU AI Act or to make or support automated decisions that produce legal or similarly significant effects on consumers without appropriate human oversight and, where required by law, disclosure and opt-out mechanisms. Subscriber shall notify Capacity if it experiences a "serious incident" or a malfunction that could lead to a breach of fundamental rights under the EU AI Act. Certain responses from the Capacity platform may be created using the Subscriber’s KnowledgeBase and other data and may be enhanced using Generative AI to improve its applicability to end users; it may contain errors or inaccuracy so Subscriber is advised to check important information.

PCI-DSS Compliance

Industry has issued Payment Card Industry Data Security Standards (“PCI DSS”) to protect cardholder data (“CHD”) and sensitive authentication data (“SAD”) wherever it is processed, stored, or transmitted. The security controls and processes required by PCI DSS are vital for protecting all payment card account data, including the primary account number printed on the front of a payment card (“PAN”).

If Subscriber’s Service Order includes PCI-DSS-covered services, i.e. Voice Virtual Agent Payments (MO/TO) functionality, to allow IFD-authenticated callers to make a payment, then the following sections apply:

1. Capacity acknowledges that to the extent that Capacity handles, has access to, or otherwise processes or transmits Subscriber’s cardholder data or sensitive authentication data via PCI DSS-covered services, Capacity shall be responsible for the security of cardholder data that Capacity possesses or otherwise processes or transmits on behalf of the Subscriber and Capacity will maintain all applicable PCI DSS requirements.

2. The processing of any CHD or SAD in any of our other Services is not recommended. . Subscriber is responsible for ensuring that its use of and other Capacity Services to store or process credit card data complies with applicable PCI DSS requirements and shall not process or store credit card data in any other Capacity Services.

3. Other than under PCI-DSS-covered services, Subscriber shall not use the Services to process CHD, SAD or PAN.

HIPAA Compliance

Capacity has met the requirements of the Health Insurance Portability and Accountability Act (HIPAA) as a Business Associate (as defined in HIPAA).

Under our Agreement, if Subscriber is a covered entity or a business associate HIPAA desiring to have Capacity process PHI as a Business Associate via HIPAA covered services, then Subscriber’s license as set forth in the Service Order must expressly include the HIPAA Package and the Business Associate Addendum available at https://capacity.com/capacity-BAA shall be incorporated herein. Other than under a HIPAA Package, Subscriber shall not use the Services to process PHI/ePHI.

If Subscriber’s engagement of Capacity’s services includes the “HIPAA Package” in the Service Order and contemplates the transmission of PHI to any Individual via text message, then Subscriber will clearly inform each User of the security risks of insecure text communications and recommend a secure option, and keep explicit records of all these risk warnings and the written approval from the User.

Subscriber acknowledges and agrees that Capacity does not maintain PHI in a Designated Record Set (as defined under HIPAA) for Subscriber.

Subscriber acknowledges and agrees that Capacity does not engage in any Covered Electronic Transactions (as defined under HIPAA) on behalf of Subscriber.

Subscriber acknowledges and agrees that HIPAA compliance and patient consent is Subscriber’s responsibility.

Finance Industry-Gramm-Leach-Bliley Act Compliance 

If the Parties have entered into a Service Order under which Subscriber is permitted to provide Capacity with non-public personal information covered by Gramm-Leach-Bliley Act and the regulations thereunder (“NPI”), and provided that Capacity is a service provider or permitted to access NPI, then Capacity acknowledges that it shall establish and maintain appropriate data security policies and procedures designed to ensure the following: (i) security and confidentiality of NPI; (ii) protection against anticipated threats or hazards to the security or integrity of NPI; and (iii) protection against the unauthorized access or use of NPI.

TCPA, Mini-TCPA state laws, and FDCPA Compliance

Subscriber is responsible for compliance with all applicable federal and state laws governing telephone calls, text messages, and debt collection, including but not limited to the Telephone Consumer Protection Act (47 U.S.C. § 227) and its implementing regulations ("TCPA"), the TRACED Act, so called “mini-TCPA” laws implemented by various states, and the Fair Debt Collection Practices Act (15 U.S.C. § 1692 et seq.) and its implementing regulations ("FDCPA"). See also Recording of Communications, Tracking Technologies and Session Replay.

Outbound Calls and Text Messages. If Subscriber uses the Services to place outbound calls or send text messages to Users, Subscriber is solely responsible for:

1. Obtaining and documenting all required consents before initiating communications, including prior express written consent where required for marketing or advertising messages, and ensuring that the type of consent obtained is appropriate for the content and purpose of the communication.
2. Honoring revocations of consent through any reasonable means by which a User may revoke, and maintaining systems to process opt-out requests promptly.
3. Maintaining and scrubbing against an internal do-not-call list and, where applicable, the National Do-Not-Call Registry.
4. Complying with time-of-day restrictions on calls and texts under federal and state law.
5. Complying with caller ID and disclosure requirements, including identification of the calling party and, for prerecorded messages, providing an automated opt-out mechanism.
6. Complying with state mini-TCPA laws, which may impose requirements more stringent than federal law, including but not limited to laws in Florida, Oklahoma, Washington, and other jurisdictions that regulate the use of automated calls, prerecorded messages, or text messages.

Telemarketing. If Subscriber uses the Services for telemarketing (as defined under the FTC's Telemarketing Sales Rule, 16 C.F.R. Part 310), Subscriber is solely responsible for compliance with the TSR, including requirements for call abandonment rates, prompt connection to a live representative, required disclosures, and restrictions on calling consumers who have requested not to be called.

Prerecorded and Artificial Voice Messages. If Subscriber uses text-to-speech or prerecorded voice functionality within the Services, Subscriber acknowledges that such communications may constitute artificial or prerecorded voice messages subject to heightened consent requirements under the TCPA and state law. Subscriber is solely responsible for determining when such requirements apply and for obtaining all necessary consents.

Debt Collection. If Subscriber uses the Services in connection with the collection of debts owed or asserted to be owed, Subscriber is solely responsible for ensuring that all communications comply with the FDCPA, Regulation F (12 C.F.R. Part 1006), and any applicable state debt collection laws, including requirements for mini-Miranda disclosures, communication frequency limitations, and prohibitions on unfair, deceptive, or abusive practices.

State Privacy Law Compliance

Subscriber is responsible for compliance with all applicable state consumer privacy laws, including but not limited to the California Consumer Privacy Act (as amended by the CPRA), Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and similar laws in other jurisdictions. This includes providing required privacy notices, honoring consumer rights requests (access, deletion, opt-out), and ensuring that Subscriber's use of the Services to collect, process, or share personal information complies with applicable requirements. Capacity's Data Processing Addendum at https://capacity.com/DPA sets forth the parties' respective obligations regarding personal data processing.